{"id":"EUVD-2025-202877","enisaUuid":"593a5e1e-5daf-32c3-9ea3-5d53c2ce415e","description":"A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.","datePublished":"Dec 11, 2025, 8:05:01 PM","dateUpdated":"Dec 15, 2025, 4:37:06 PM","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://www.facebook.com/security/advisories/cve-2025-55184\nhttps://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\n","aliases":"CVE-2025-55184\nGHSA-2m3v-v2m8-q956\n","assigner":"Meta","epss":66.62,"enisaIdProduct":[{"id":"3b5c7c13-428b-3055-ba1a-ce2ec4f124e4","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"3b90c57a-d5a3-3245-86b0-b10dc0869aca","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"3d6c8109-abd5-3547-a324-e6b59c4eb785","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"78fe69c0-540a-3a90-8166-5f5c9dc8768e","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"ab25b1d6-8569-3a5c-a1c8-a807fccfeeb7","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"b8f19a90-04d4-3dfd-bb69-bf36b73c5df9","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"c7550f1a-3846-36b5-b2c8-0eb8552122e0","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"f1e15461-0617-3340-9bdd-7289ced85da2","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"f3d82f59-6f32-38dc-b14d-0e15f7e8dd2e","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"}],"enisaIdVendor":[{"id":"3c42f7f1-56da-301c-ac37-14eb6a7eaeeb","vendor":{"name":"Meta"}}],"enisaIdVulnerability":[{"id":"95f9c7b8-8729-3a14-9397-7854e6db07aa","vulnerability":{"id":"GHSA-2m3v-v2m8-q956","description":"Denial of Service Vulnerability in React Server Components","datePublished":"Dec 11, 2025, 10:36:44 PM","dateUpdated":"Dec 11, 2025, 10:36:45 PM","baseScore":0.0,"references":"https://github.com/facebook/react/security/advisories/GHSA-2m3v-v2m8-q956\nhttps://nvd.nist.gov/vuln/detail/CVE-2025-55184\nhttps://github.com/facebook/react\nhttps://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\nhttps://www.facebook.com/security/advisories/cve-2025-55184\n","enisa_id":"EUVD-2025-202877\n","aliases":"CVE-2025-55184\nGHSA-2m3v-v2m8-q956\n","epss":0.0,"dataProcessed":"Nov 1, 2026, 1:56:58 AM","vulnerabilityProduct":[],"vulnerabilityVendor":[]}},{"id":"b45ce9fb-f829-3a42-8351-04fd40a2595d","vulnerability":{"id":"CVE-2025-55184","description":"A pre-authentication denial of service vulnerability exists in React Server Components versions 19.0.0, 19.0.1 19.1.0, 19.1.1, 19.1.2, 19.2.0 and 19.2.1, including the following packages: react-server-dom-parcel, react-server-dom-turbopack, and react-server-dom-webpack. The vulnerable code unsafely deserializes payloads from HTTP requests to Server Function endpoints, which can cause an infinite loop that hangs the server process and may prevent future HTTP requests from being served.","datePublished":"Dec 11, 2025, 8:05:01 PM","dateUpdated":"Dec 15, 2025, 4:37:06 PM","status":"PUBLISHED","baseScore":7.5,"baseScoreVersion":"3.1","baseScoreVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","references":"https://www.facebook.com/security/advisories/cve-2025-55184\nhttps://react.dev/blog/2025/12/11/denial-of-service-and-source-code-exposure-in-react-server-components\n","enisa_id":"EUVD-2025-202877\n","assigner":"Meta","epss":66.62,"dataProcessed":"Nov 6, 2026, 7:13:53 AM","vulnerabilityProduct":[{"id":"29718a4a-3dce-35c4-8c2a-2cd4efceb7d1","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"3719b61a-a05d-3da1-9d44-e4c897b1b714","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"51de8ff6-345a-3337-8869-9cbfac576633","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"524c6bc7-2a4b-3714-95fa-0c6db7043d22","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"8f6be66c-9430-34f0-9789-c7442191625c","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"},{"id":"9060da30-fae5-3575-971b-0e596af2cf10","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"9ac5b7f4-904d-3a1a-8442-ab5b3a0de565","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}},"product_version":"19.2.0 ≤19.2.1"},{"id":"c5f6e7c3-7d90-37f5-a84a-4930ebff7be3","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.0.0 ≤19.0.1"},{"id":"d129800a-9edf-3b2d-a207-ff0c73c136d9","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}},"product_version":"19.1.0 ≤19.1.2"}],"vulnerabilityVendor":[{"id":"c1c9476b-07dc-3fee-a4c5-1cb55e9cdf2c","vendor":{"name":"Meta"}}]}}],"enisaIdAdvisory":[{"id":"7621add7-68de-3a6f-b95e-41bf77897517","advisory":{"id":"WID-SEC-W-2026-3046","description":"IBM Concert: Mehrere Schwachstellen","summary":"Ein Angreifer kann mehrere Schwachstellen in IBM Concert ausnutzen, um beliebigen Programmcode auszuführen, um einen Denial of Service Angriff durchzuführen, um Informationen offenzulegen, um Dateien zu manipulieren, um einen Cross-Site Scripting Angriff durchzuführen, um einen SQL-Injection Angriff durchzuführen und um Sicherheitsvorkehrungen zu umgehen.","datePublished":"Aug 26, 2026, 10:00:00 PM","dateUpdated":"Aug 30, 2026, 10:00:00 PM","baseScore":0.0,"references":"https://wid.cert-bund.de/.well-known/csaf/white/2026/wid-sec-w-2026-3046.json\nhttps://wid.cert-bund.de/portal/wid/securityadvisory?name\u003dWID-SEC-2026-3046\n","aliases":"CVE-2019-19921\nCVE-2021-23337\nCVE-2024-3651\nCVE-2024-39338\nCVE-2024-45590\nCVE-2025-13465\nCVE-2025-15284\nCVE-2025-15599\nCVE-2025-22874\nCVE-2025-47273\nCVE-2025-47907\nCVE-2025-52881\nCVE-2025-53643\nCVE-2025-55184\nCVE-2025-58056\nCVE-2025-58188\nCVE-2025-58189\nCVE-2025-61723\nCVE-2025-61730\nCVE-2025-64649\nCVE-2025-64756\nCVE-2025-67221\nCVE-2025-68121\nCVE-2025-68146\nCVE-2026-0540\nCVE-2026-2327\nCVE-2026-23490\nCVE-2026-23897\nCVE-2026-2391\nCVE-2026-23949\nCVE-2026-24486\nCVE-2026-25528\nCVE-2026-25547\nCVE-2026-25639\nCVE-2026-25990\nCVE-2026-26007\nCVE-2026-26019\nCVE-2026-26996\nCVE-2026-27142\nCVE-2026-27212\nCVE-2026-27699\nCVE-2026-27903\nCVE-2026-27904\nCVE-2026-28684\nCVE-2026-29063\nCVE-2026-29181\nCVE-2026-2950\nCVE-2026-31808\nCVE-2026-31900\nCVE-2026-32274\nCVE-2026-32288\nCVE-2026-32597\nCVE-2026-32630\nCVE-2026-32887\nCVE-2026-32952\nCVE-2026-33186\nCVE-2026-33532\nCVE-2026-33750\nCVE-2026-33814\nCVE-2026-33816\nCVE-2026-33916\nCVE-2026-34043\nCVE-2026-34073\nCVE-2026-34077\nCVE-2026-3520\nCVE-2026-35469\nCVE-2026-35515\nCVE-2026-3627\nCVE-2026-39823\nCVE-2026-39825\nCVE-2026-39826\nCVE-2026-39892\nCVE-2026-39984\nCVE-2026-40175\nCVE-2026-40179\nCVE-2026-40181\nCVE-2026-40190\nCVE-2026-40347\nCVE-2026-41066\nCVE-2026-41182\nCVE-2026-41238\nCVE-2026-41239\nCVE-2026-41240\nCVE-2026-41305\nCVE-2026-41324\nCVE-2026-41425\nCVE-2026-41481\nCVE-2026-41488\nCVE-2026-41602\nCVE-2026-41636\nCVE-2026-42151\nCVE-2026-42154\nCVE-2026-42198\nCVE-2026-42211\nCVE-2026-42338\nCVE-2026-42342\nCVE-2026-42561\nCVE-2026-42577\nCVE-2026-43870\nCVE-2026-44405\nCVE-2026-44431\nCVE-2026-44432\nCVE-2026-44486\nCVE-2026-44487\nCVE-2026-44488\nCVE-2026-44492\nCVE-2026-44494\nCVE-2026-44496\nCVE-2026-44728\nCVE-2026-4539\nCVE-2026-45409\nCVE-2026-45736\nCVE-2026-46625\nCVE-2026-4800\nCVE-2026-4923\nCVE-2026-4926\nCVE-2026-7246\nCVE-2026-8723\n","source":{"id":8,"name":"csaf_certbund"},"advisoryProduct":[{"id":"76a90dbd-da59-3443-a232-e3bd24181126","product":{"name":"Concert","vendor":{"name":"IBM"}}},{"id":"cc1d243a-3c05-3835-99df-7ead0933e4bb","product":{"name":"3.0.0","vendor":{"name":"ECOVACS"}}}]}},{"id":"789271d7-59f2-3c52-9ec1-12ab469b3dbd","advisory":{"id":"NCSC-2025-0394","description":"Kwetsbaarheden verholpen in React Server Components","datePublished":"Dec 12, 2025, 9:04:19 AM","dateUpdated":"Dec 12, 2025, 10:46:34 AM","baseScore":0.0,"references":"","aliases":"CVE-2025-67779\nCVE-2025-55183\nCVE-2025-55184\n","source":{"id":19,"name":"csaf_ncscnl"},"advisoryProduct":[{"id":"023cae77-cc29-3da8-91e3-411d216361d7","product":{"name":"react-server-dom-turbopack","vendor":{"name":"Meta"}}},{"id":"8d6c583b-3df6-3d91-898f-2bde4a061614","product":{"name":"react-server-dom-webpack","vendor":{"name":"Meta"}}},{"id":"8ea15e91-418c-3881-a6f4-ac2b0c3ba239","product":{"name":"react-server-dom-parcel","vendor":{"name":"Meta"}}},{"id":"dcbbf9f7-a69c-32aa-ae87-c66c73657ae7","product":{"name":"vers:unknown/*","vendor":{"name":"Cisco"}}}]}}]}